LibreChat/api/server/services
Dustin Healy 4cec1a675f
🔒 feat: Add allowedAddresses Exemption to Speech (STT/TTS) and OCR Config Schemas (#14559)
* feat: add allowedAddresses exemption to speech (STT/TTS) and OCR config schemas

Add the existing allowedAddressesSchema as an optional field on sttSchema,
ttsSchema, and ocrSchema, reusing the schema already attached to endpoints,
mcpSettings, and actions so port scoping and normalization stay identical.

STT and TTS resolve a single provider by counting non-empty section keys, so
exclude the allowedAddresses key from that scan. Without the exclusion a
configured exemption list would be counted as a second provider and trip the
"Multiple providers are set" guard. The field is inert on its own: nothing
reads it for SSRF yet, and provider detection now ignores it.

* fix: preserve allowedAddresses through the OCR config loaders

loadOCRConfig rebuilt the ocr config with only apiKey, baseURL,
mistralModel, and strategy, dropping allowedAddresses before it reached
req.config.ocr. Pass it through in both the AppService loader
(packages/data-schemas/src/app/ocr.ts) and the duplicate at
packages/api/src/files/ocr.ts so the exemption survives config load.
2026-08-05 13:42:43 -04:00
..
__tests__ 🧱 fix: Enforce Agent Runtime File Trust Boundaries (#14577) 2026-08-02 14:18:28 -04:00
Agents 🔒 fix: Remove Owner Email from Agent owner_contact Fallback (#14541) 2026-07-30 23:46:22 -04:00
Artifacts 🧵 fix: Preserve Fenced Markdown Artifacts (#14121) 2026-07-05 12:04:59 -04:00
Config ⚙️ perf: reduce first-load MongoDB round trips (#14101) 2026-07-06 09:36:34 -04:00
Endpoints 🪪 fix: Strip Unresolved Header Placeholders at Final Resolution (#14595) 2026-08-02 06:38:06 -04:00
Files 🔒 feat: Add allowedAddresses Exemption to Speech (STT/TTS) and OCR Config Schemas (#14559) 2026-08-05 13:42:43 -04:00
Runs
Skills 🧬 feat: Add GitHub Skill Sync (#13293) 2026-06-10 21:05:54 -04:00
start 🙋 feat: ask_user_question - agent-initiated questions with durable pause/resume (#14139) 2026-07-08 15:31:05 -04:00
Threads
Tools 🪟 fix: Surface MCP Initialization Errors (#14529) 2026-07-30 13:22:11 -04:00
ActionService.js 🛂 test: Cover Tool Approval Workflows End to End (#14427) 2026-07-26 21:58:25 -04:00
ActionService.spec.js 🛂 test: Cover Tool Approval Workflows End to End (#14427) 2026-07-26 21:58:25 -04:00
AssistantService.js
AuthService.js 🔡 fix: Normalize Email Case When Issuing Verification Tokens (#14172) 2026-07-09 08:42:39 -04:00
AuthService.spec.js 🔡 fix: Normalize Email Case When Issuing Verification Tokens (#14172) 2026-07-09 08:42:39 -04:00
cleanup.js
createRunBody.js
GraphApiService.js
GraphApiService.spec.js
GraphTokenService.js 🔒 feat: Add On-Behalf-Of (OBO) token exchange support for MCP Servers (#13429) 2026-06-01 22:36:18 -04:00
initializeMCPs.js 🔐 fix: Honor Admin-Panel MCP Allowlist Overrides Without Restart (#13814) 2026-06-17 20:14:53 -04:00
initializeMCPs.spec.js 🔐 fix: Honor Admin-Panel MCP Allowlist Overrides Without Restart (#13814) 2026-06-17 20:14:53 -04:00
initializeOAuthReconnectManager.js
MCP.js 🔗 fix: Normalize MCP Tool Keys at Every Producer, Resolve Raw Names via Aliases (#14553) 2026-08-01 07:39:24 -04:00
MCP.spec.js 🛂 test: Cover Tool Approval Workflows End to End (#14427) 2026-07-26 21:58:25 -04:00
MCPRequestContext.js 🪢 fix: Tie MCP Cleanup To Resumable Runs (#13769) 2026-06-15 15:26:03 -04:00
OboPolicyService.js 🔒 feat: Add On-Behalf-Of (OBO) token exchange support for MCP Servers (#13429) 2026-06-01 22:36:18 -04:00
OboTokenService.js 🔒 feat: Add On-Behalf-Of (OBO) token exchange support for MCP Servers (#13429) 2026-06-01 22:36:18 -04:00
OboTokenService.spec.js 🔒 feat: Add On-Behalf-Of (OBO) token exchange support for MCP Servers (#13429) 2026-06-01 22:36:18 -04:00
PermissionService.js 🚪 fix: Keep Owners From Being Locked Out of Their Own Resource When Sharing (#14347) 2026-07-20 22:27:25 -04:00
PermissionService.spec.js 🚪 fix: Keep Owners From Being Locked Out of Their Own Resource When Sharing (#14347) 2026-07-20 22:27:25 -04:00
PluginService.js
systemGrant.spec.js
ToolService.js 🧱 fix: Enforce Agent Runtime File Trust Boundaries (#14577) 2026-08-02 14:18:28 -04:00
twoFactorService.js